MS-102 - Microsoft 365 Administrator Expert Implementing Data Loss Prevention Questions and Answers — Questions and Answers
Question 1: An administrator needs to create a single Data Loss Prevention (DLP) policy to prevent the accidental sharing of documents containing credit card numbers. The policy must apply to users' corporate email, their OneDrive for Business accounts, and also block the upload of these files to non-allowed cloud services from their managed Windows 11 devices. Which locations must be selected in the DLP policy configuration?
- Exchange Online, SharePoint Online, and OneDrive for Business
- Microsoft Teams chat and channel messages, and Devices
- Exchange Online, OneDrive for Business, and Devices (Correct answer)
- Exchange Online and Microsoft Defender for Cloud Apps
Correct answer: Exchange Online, OneDrive for Business, and Devices
To meet all requirements, the policy must cover three distinct locations. 'Exchange Online' is required to monitor corporate email. 'OneDrive for Business' is needed to monitor files within the user's corporate cloud storage. The 'Devices' location (Endpoint DLP) is essential for monitoring and blocking actions on managed endpoints, such as preventing uploads of sensitive files to unapproved cloud services. Selecting only Exchange, SharePoint, and OneDrive would miss the endpoint protection requirement, and Defender for Cloud Apps is a separate, though related, service.
Question 2: You are configuring a new Data Loss Prevention (DLP) policy in 'Test it out first' mode. Your goal is to educate users about the company's data handling policies without immediately blocking their actions. Which of the following configurations is MOST appropriate for this initial educational phase?
- Set the policy action to 'Block everyone' and customize the email notification.
- Enable the policy and only configure policy tips to show to users. (Correct answer)
- Set the policy action to 'Restrict access' and disable all user notifications.
- Configure the policy to only generate an incident report for administrators.
Correct answer: Enable the policy and only configure policy tips to show to users.
The 'Test it out first' mode allows a DLP policy to be enabled without enforcing restrictive actions. Configuring it to only show policy tips is the ideal way to meet the educational goal. This setup makes users aware of potential policy violations in real-time as they are about to share sensitive information, but it does not block their workflow. Blocking everyone is too restrictive for an initial phase, restricting access without notification causes confusion, and only generating an admin report fails to educate the end-user.
Question 3: An administrator is creating a custom Sensitive Information Type (SIT) to detect a unique internal project code with the format 'PROJ-' followed by exactly six digits (e.g., PROJ-123456). Which of the following should be used as the primary element to define this specific pattern?
- A keyword dictionary
- A document fingerprint
- A trainable classifier
- A regular expression (Correct answer)
Correct answer: A regular expression
A regular expression (regex) is the ideal primary element for defining a specific, repeatable pattern like 'PROJ-' followed by six digits. A regex such as `PROJ-\d{6}` would accurately match this format. A keyword dictionary is impractical for a large number of unique codes, a document fingerprint detects entire forms, and a trainable classifier is for less-structured data.
Question 4: An organization wants to implement Endpoint Data Loss Prevention (DLP) to monitor and control activities on their corporate Windows 11 devices. Which of the following is a mandatory prerequisite for these devices to be covered by Endpoint DLP policies?
- The devices must be onboarded into Microsoft Defender for Endpoint. (Correct answer)
- The devices must be managed by a third-party MDM solution.
- The Microsoft Purview Information Protection client must be installed on the devices.
- The devices must have BitLocker drive encryption enabled.
Correct answer: The devices must be onboarded into Microsoft Defender for Endpoint.
Endpoint DLP leverages the sensor and enforcement capabilities built into modern Windows operating systems. For the Microsoft Purview compliance portal to manage and apply DLP policies to a device, that device must first be onboarded into the Microsoft Defender for Endpoint service. This onboarding process establishes the necessary communication and management channel for the DLP engine.
Question 5: An administrator has configured two active Data Loss Prevention (DLP) policies: - Policy 1 (Priority 0): Blocks external sharing of any content containing a single U.S. credit card number. - Policy 2 (Priority 1): Shows a policy tip if content containing any financial data (including credit card numbers) is detected. A user attempts to email a document containing one U.S. credit card number to an external recipient. What is the expected outcome?
- The email is sent, and the user sees a policy tip.
- The email is blocked, and the user also sees a policy tip. (Correct answer)
- The email is blocked, and no policy tip is shown.
- Both policies are ignored, and the email is sent successfully.
Correct answer: The email is blocked, and the user also sees a policy tip.
Microsoft 365 DLP policies are processed in order of priority (lowest number first), and their actions are aggregated. The most restrictive action will always be enforced. In this case, Policy 1 has the highest priority and its 'Block' action is the most restrictive, so the email will be blocked. However, because Policy 2 also matches the content, its action (showing a policy tip) is also applied. Therefore, the user experiences both the block and the notification.
Question 6: A security administrator is configuring a Data Loss Prevention (DLP) policy and wants to ensure that an email alert is sent to the security operations team every time a user overrides a policy by providing a business justification. Which setting within the DLP policy configuration should be used to achieve this?
- Configure an audit log search for 'DLP policy override' events.
- Modify the 'User notifications' section to CC the security team.
- Create a separate mail flow rule in the Exchange admin center.
- Customize the 'Incident reports' settings and enable notifications. (Correct answer)
Correct answer: Customize the 'Incident reports' settings and enable notifications.
The 'Incident reports' section within a DLP policy is where administrators can configure alerts based on policy match severity and specific events. This section includes a specific option to send an alert 'When a user overrides a policy,' which directly meets the requirement. User notifications are intended for the end-user, an audit log search is not a real-time alert, and a mail flow rule is an external mechanism.
MS-102 - Microsoft 365 Administrator Expert Implementing Data Loss Prevention Questions and Answers
An administrator needs to create a single Data Loss Prevention (DLP) policy to prevent the accidental sharing of documents containing credit card numbers.
The policy must apply to users' corporate email, their OneDrive for Business accounts, and also block the upload of these files to non-allowed cloud services from their managed Windows 11 devices.
Which locations must be selected in the DLP policy configuration?